EUVD-2026-87289

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

CVE-2026-97228

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

EUVD-2026-86930

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97228

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 are vulnerable to a GraphQL query injection in the export-status component. Specifically, the get_export_status function in src/export_manager.py fails to validate the export_id argument, which is received via the check_rapid7_export_status and ...

CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

cve-2024-4577-phpcgi_rce_reproduction

CVE-2024-4577 - Inyección de Argumentos CGI en PHP en Windows "WorstFit" Resumen CVE-2024-4577 es una vulnerabilidad crítica de ejecución remota de código en la implementación CGI de PHP en Windows. Evita el parche para el CVE-2012-1823 original explotando la conversión de páginas de código...

EUVD-2026-86534

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-92212 JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – Envenenamiento de caché HTTP mediante un parámetro de consulta no clave Descripción general Una caché web utiliza únicamente la ruta de la URL como clave de caché, ignorando los parámetros de consulta. Un atacante puede añadir una carga útil maliciosa a un parámetro no clave p...

dnsprobe

注意 - 该项目已停止维护。新的更新和修复将推送到 dnsx。 DNSProbe 是一个基于 retryabledns 构建的工具，允许你使用用户提供的解析器列表执行多个选择的 DNS 查询。 资源 资源 功能 用法 安装说明 从源码安装 在 Docker 容器中运行 查询主机的 A 记录 查询主机的 CNAME 记录 查询 Subfinder 输出的 CNAME 记录 许可证 功能 简单便捷的 DNS 记录查询工具。 用法 dnsprobe -h 这将显示工具的帮助信息。以下是所有支持的选项。 标志| 描述| 示例 ---|---|--- -c| 最大 DNS 重试次数（默认 1）|...

Gitmails

Development - IMPORTANT This Gitmails version is no longer maintained. Check out the Gitmails Shell port if you want to use a version that is maintained and, hopefully, developed. If you do not want to use the shell port and prefer the Python version, feel free to fork Gitmails and direct it to...

CVE-2026-21004-SQLite-FTS3-Match-Infoleak-via-Query-Crafting

CVE-2026-21004 – Fuga de información de coincidencias SQLite FTS3 mediante manipulación de consultas Código del programa Python sqliteftsleak.py - Creates FTS table and exploits match info import sqlite3 conn = sqlite3.connect':memory:' conn.execute"CREATE VIRTUAL TABLE secrets USING fts4content...

CVE-2012-1823---PHP-CGI---RCE

CVE-2012-1823 | Exploit de ejecución remota de código RCE en PHP-CGI Un exploit basado en Python para CVE-2012-1823. Esta vulnerabilidad permite a un atacante ejecutar código arbitrario en un servidor que ejecuta una versión vulnerable de PHP-CGI mediante la inyección de argumentos de línea de...

Apache Solr <= 7.1 - XML Entity Injection

Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...

SPIP BigUp Plugin - Remote Code Execution

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. id: CVE-2024-8517 info: name: SPIP BigUp Plugin - Remote Code Execution...

dns-honeypot

Mis Primeras 24 Horas Ejecutando un Honeypot DNS Como ingeniero que pasa la mayor parte de mis días inmerso en herramientas de observabilidad, de vez en cuando tengo una idea que simplemente tengo que llevar a cabo. Este fue uno de esos experimentos: levantar un resolvedor DNS en una IP limpia qu...

CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC-

CVE-2025-2945 – RCE autenticado en pgAdmin4 PoC Este repositorio contiene un script de prueba de concepto creado para investigación de seguridad y pruebas de penetración autorizadas que involucran la vulnerabilidad CVE-2025-2945 , que afecta a ciertas versiones de pgAdmin4. El problema permite qu...